fix: use /mcp base_url for OAuth metadata endpoints

[TMogdans]

Summary

• Fix OAuth base_url in ContextMineGitHubProvider to use /mcp instead of /api
• OAuth metadata now returns correct endpoint URLs matching the MCP mount point

Problem

The OAuth authorization server metadata returned endpoint URLs under /api/...:

{
  "authorization_endpoint": "http://localhost:8000/api/authorize",
  "token_endpoint": "http://localhost:8000/api/token",
  "registration_endpoint": "http://localhost:8000/api/register"
}

But the actual endpoints served by FastMCP are at /mcp/... (where the MCP sub-app is mounted). This caused MCP clients to fail during OAuth client registration:

POST /api/register → 405 Method Not Allowed
POST /mcp/register → Works correctly

Fix

Changed base_url from {mcp_oauth_base_url}/api to {mcp_oauth_base_url}/mcp in apps/api/app/mcp_auth.py.

Test plan

• Start ContextMine with GitHub OAuth configured
• Verify GET /mcp/.well-known/oauth-authorization-server returns URLs under /mcp/...
• Verify POST /mcp/register works with the metadata-advertised URL
• Verify MCP client (mcp-remote) can complete OAuth registration step

Fixes #1

🤖 Generated with Claude Code

[TMogdans]

Note: The Semgrep CI failure is pre-existing on the main branch and unrelated to this change. Lint, type check, and tests all pass.